Privacy notice — Emolysis

1. Who is responsible

Bandpey GmbH is the controller for the processing described in this notice.

Bandpey GmbH, Gmunder Str. 20b, 81379 Munich, Germany.
Email: hello@emolysis.com

Send questions about this notice, and requests to use your rights, to that email address. You can write in English or German.

2. The short version

This website collects very little, and this is all of it:

This website loads Google Analytics and Microsoft Clarity and sets their cookies once you choose “Accept essentials” or “Accept all” in the cookie banner, or confirm your choice on the cookie preferences page; every choice includes both (section 5). Before you choose, it sets no cookies. “Cookie settings” at the bottom of every page opens the cookie preferences page.
Apart from those two, its pages load no fonts, scripts or content from other servers, except the bot check on the request-access page (section 8). It uses no advertising or social media plug-ins.
Its one form is the request form on the request-access page. If you use it, we process what you enter and keep it until you ask us to delete it (section 7). It has no comments.
If you tick the newsletter box on that form and confirm by email, we send you the newsletter until you unsubscribe (section 9).
Signing in to an Emolysis account with GitHub, Microsoft or Google is in testing and not yet offered to the public. If you sign in, we receive your name, email address and account ID from that provider and use them only to sign you in and run your account (section 10).
If you connect Microsoft Fabric in the Emolysis app, the app works with your own Microsoft permissions, directly from your computer, and our services are designed never to receive that sign-in or your Fabric credentials (section 11).
Your browser keeps your theme choice and your choice in the cookie banner in its own local storage. They stay on your device (section 4).
Our hosting provider records technical data about each request in server logs (section 3).
If you email us, we process what you send (section 6).

3. Visiting this website: server logs

When you open a page, your browser asks our hosting provider's servers for it. To answer, and to keep the service secure, the provider processes technical data about the request: your IP address, the date and time, the address of the page or file requested, the response status and size, the page you came from if your browser sends it, and your browser and operating system as your browser reports them.

We process this data to deliver the website, keep it secure and find and fix errors. The legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). The website cannot be delivered without it.

Our hosting provider processes the data on our behalf. We do not use the logs to identify visitors, and we do not combine them with other data. The provider keeps them only as long as needed for the purposes above.

The provider may process data on servers in several countries, including outside the European Economic Area. Where that happens, we rely on an adequacy decision of the European Commission where one covers the transfer (for the United States, the EU-US Data Privacy Framework, for providers certified under it), and otherwise on standard contractual clauses.

4. What your browser stores

Until you choose in the cookie banner (section 5), this website's pages set no cookies. They use your browser's local storage for the entries below. They stay on your device: the website's own pages read them to show the page as you set it and to know your choice in the cookie banner, and they are never sent to us or to anyone else. You can delete them at any time in your browser's settings, and the website works without them; without your choice, the banner asks again. Signing in uses a few cookies and two session storage entries of its own, listed in section 10.

emo-theme. Your theme choice: light or dark. Set when you use the theme switch. Read on every page load to apply your choice.
emo-cookie-consent. Your choice in the cookie banner or on the cookie preferences page, and when you made it. Set when you choose. Read on every page load; after 12 months the banner asks again.

The entries do not identify you. We store your theme choice because you ask for it by using the theme switch, and your choice in the cookie banner because you make it there and we must respect it on the next page. Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) allows both without consent.

5. Website analytics

When you choose “Accept essentials” or “Accept all” in the cookie banner, or confirm your choice on the cookie preferences page, this website loads Google Analytics and Microsoft Clarity. Every choice includes both. We use them to see how visitors use the website, which pages they read and where they stop, so we can improve it. Before you choose, neither is loaded and no request goes to Google or Microsoft. Neither is ever loaded in the signed-in Emolysis account or on shared dashboards.

Google Analytics is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It records the pages you open and the page you came from, how far you scroll, links you follow to other websites, when you send the request form and whether you ticked the newsletter box on it, the time of each, your device type, browser, operating system, screen size and language, and your approximate location (country and region), which Google derives from your IP address. Google Analytics does not log or store IP addresses of visitors in the EU. It identifies your browser by a random ID in a cookie. We keep the data in Google Analytics for 2 months. Google processes it on our behalf. We do not use Google signals, advertising features or any advertising storage.

Microsoft Clarity is provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. It records how you use the pages, as heatmaps and as replays of mouse movements, clicks and scrolling. What you type into a form is masked and never recorded, and the request form is masked entirely. Clarity keeps replays for 30 days and heatmaps for 9 months. Microsoft Clarity is offered together with Microsoft Advertising: Microsoft collects this usage data with first- and third-party cookies and similar technologies and uses it for site optimization, fraud and security purposes and its own advertising. We use it only to improve this website, and we tell Clarity that advertising storage is denied. How Microsoft collects and uses data is described in the Microsoft Privacy Statement.

We have linked Clarity to Google Analytics, so we can open the Clarity replay of a visit we see in Google Analytics. We never send either provider your name, your email address or anything you type, and the page addresses they receive carry no query parameters except campaign tags (utm_). Neither receives the address of a shared dashboard.

The legal basis is your consent, which you give with your choice in the cookie banner or on the cookie preferences page (Art. 6(1)(a) GDPR, and for storing and reading cookies on your device section 25(1) TDDDG). You can withdraw it at any time with effect for the future: delete this website's cookies and site data in your browser's settings. The banner then asks again, and nothing loads until you choose. Microsoft's own cookies on clarity.ms and bing.com can only be deleted in your browser's settings too.

Google and Microsoft may process the data in the United States. For those transfers we rely on an adequacy decision of the European Commission where one covers the transfer (for the United States, the EU-US Data Privacy Framework, for providers certified under it), and otherwise on standard contractual clauses. Both companies are certified under the EU-US Data Privacy Framework, and their data processing terms include the standard contractual clauses.

The cookies and storage the website analytics use:

Name	Provider	Purpose	Kept	Category
`emo-cookie-consent`	This website (local storage)	Stores your choice in the cookie banner.	12 months	Strictly necessary
`_ga`	Google, first-party	Distinguishes visitors.	2 years	Analytics
`_ga_MBKCSQSNYS`	Google, first-party	Keeps the session state.	2 years	Analytics
`_clck`	Microsoft Clarity, first-party	Clarity's visitor ID and preferences.	1 year	Analytics
`_clsk`	Microsoft Clarity, first-party	Joins page views into one session replay.	1 day	Analytics
`_cltk`	Microsoft Clarity, session storage	Keeps a replay to one browser tab.	Until the tab closes	Analytics
`CLID, MUID, MR, SM, ANONCHK`	Microsoft, third-party (clarity.ms, bing.com)	Recognize the browser across Microsoft services.	Up to 1 year	Analytics

6. Emails you send us

Some links on this website open your own email app with a prefilled message. Nothing is sent to us until you send it.

If you email us, we process your email address, your name if you give it, the content of your message and the date and time. We use it to answer you, to run the early access program if you ask for it, to handle support requests and security reports, and to keep a record of our correspondence.

The legal basis is Art. 6(1)(b) GDPR where you ask about a contract or steps before one, and otherwise our legitimate interest in answering the people who write to us (Art. 6(1)(f) GDPR). Writing to us is voluntary.

We keep a message for as long as we need it to deal with your request, and longer where the law requires us to keep business correspondence, which is generally six years under German commercial and tax law. Then we delete it. Our email and IT providers process messages on our behalf.

Email is not encrypted from end to end by default. Please do not send credentials, keys or customer data.

7. Requesting access through the form

On the request-access page you can ask for early access. When you send the form, we process what you enter: your name and email address (required), and, if you give them, your company, your role, your company's size, your data platforms and what you would use Emolysis for. We also store whether you asked for the newsletter, the version of the privacy text the form showed you, and the date and time of the request.

We use this data to answer your request, to decide about and organize access to Emolysis, and to follow up with you about it. We keep it in our customer relationship management (CRM) system, and our team gets a notification of each request by email. We may send you a short email confirming that a request from your address arrived; it repeats nothing you entered.

The legal basis is Art. 6(1)(b) GDPR: steps before a contract that you asked for. Giving the data is voluntary, but without a name and an email address we cannot answer a request. You can also ask by email instead (section 6).

To keep bots and abuse out, the form also sends a one-time token from the bot check (section 8) and a token showing when the page was opened, and our service limits how many requests it takes in a short time. For the limit, your IP address is used only in passing, as part of a keyed one-way hash together with your email address. We do not store your IP address, your browser's details or either token with your request. The legal basis is our legitimate interest in keeping bots and abuse out (Art. 6(1)(f) GDPR).

We keep your request, its record in our CRM and our notifications of it until you ask us to delete them; there is no fixed period. To ask, email hello@emolysis.com. Deleting also ends a newsletter subscription. The service we send our emails with keeps a log of each email it sends (the recipient and the subject) for up to about a month.

Our hosting provider runs the service that receives the form, the bot check and the sending of our emails; our email provider hosts the mailbox that receives our team's notification of each request, which lists what you entered; and our CRM provider stores the contact records. They process the data on our behalf. They may process data outside the EU, including in the United States; for those transfers we rely on an adequacy decision of the European Commission where one covers the transfer (for the United States, the EU-US Data Privacy Framework, for providers certified under it), and otherwise on standard contractual clauses.

8. The bot check on the request-access page

The request-access page uses Turnstile, a bot check that our hosting provider runs. When you start filling in the form on that page, your browser loads it from the provider's servers, and it runs in its own frame; opening the page alone does not load it. To tell people from bots, it processes technical data about your browser, your device and your connection, such as your IP address, and it gives the form a one-time token that our service checks with the provider when you send the form. No other page of this website loads it.

The legal basis is our legitimate interest in protecting the form from bots and abuse (Art. 6(1)(f) GDPR). Reading this information in your browser is strictly necessary to provide the form you are using, which section 25(2) no. 2 TDDDG allows without consent. The provider may process the data outside the EU, including in the United States; for those transfers we rely on an adequacy decision of the European Commission where one covers the transfer (for the United States, the EU-US Data Privacy Framework, for providers certified under it), and otherwise on standard contractual clauses.

10. Signing in with GitHub, Microsoft or Google

Emolysis accounts are in testing and not yet offered to the public: on this website the account page is still a request form. Our sign-in service, which the Emolysis app and the emo command line use, accepts any email address the provider has verified; its test version accepts sign-in from Emolysis team addresses only. Before accounts open, we will update this section. You sign in with an account you already have at GitHub, Microsoft or Google, on that provider's own sign-in page; we never see your password there.

What we receive. When you agree on the provider's page, it sends our sign-in service your account ID at that provider, your email address and whether the provider has verified it, and your name; depending on the provider, also your username and the address of your profile picture. We ask only for this basic profile: the openid, email and profile scopes at Google and Microsoft, and read:user and user:email at GitHub. We get no access to your mailbox, files, contacts, calendar or repositories.

What we keep. Your verified email address: on your account as it was when the account was created, and for each provider you sign in with as that provider last sent it. Your display name, taken once when your account is created: your name, or, if the provider sends none, your GitHub username or the part of your email address before the @. The account ID at each provider you sign in with, so that sign-ins with the same verified email address reach one account. When your account was created and when you last signed in with each provider. The personal organization your account gets is named after your display name, and its short name is made from your GitHub username or from the part of your email address before the @. We do not keep your profile picture or anything else from your provider account. For each session we keep when it started, which Emolysis app it belongs to and whether it has ended; its tokens are stored only as one-way hashes. A security log of sign-ins and sessions holds internal identifiers and times, which provider or Emolysis app was used and why a session ended, not your email address or name.

What we use it for. Only to sign you in, to create and run your Emolysis account, to link the ways you sign in to that one account, and to keep signing in secure, for example by ending a session when one of its tokens is used twice. We do not use it for advertising or profiling, and we do not add you to the newsletter. The legal basis is Art. 6(1)(b) GDPR: providing the account you ask for. For the security log it is our legitimate interest in secure accounts (Art. 6(1)(f) GDPR).

Who receives it. We do not sell this data, share it for advertising, or pass it to anyone else, except our hosting provider, which runs our sign-in service and its database on our behalf, and where the law requires it. Requests to the sign-in service are also recorded in our hosting provider's server logs, as in section 3. The provider you sign in with learns that you signed in to Emolysis; its own privacy notice applies to that. Our hosting provider may process the data outside the EU, including in the United States; for those transfers we rely on an adequacy decision of the European Commission where one covers the transfer (for the United States, the EU-US Data Privacy Framework, for providers certified under it), and otherwise on standard contractual clauses.

Cookies and browser storage. Signing in needs these cookies, which our sign-in service sets on its own address:

__Host-emo_oauth. The one-time values of a sign-in in progress: its state, its code verifier, a nonce and the provider you chose. Kept for 10 minutes.
__Host-emo_authz. Set only when the Emolysis desktop app or command line opens signing in in your browser: when it did, and a one-way hash of its request, so that you are not asked to confirm again right after you sign in. Kept for 10 minutes.
__Host-emo_session. Your session on the sign-in service's own pages. Kept for 1 hour.
__Host-emo_refresh. What keeps you signed in on the website. It is replaced each time it is used. Kept for 30 days, or until you sign out.

It also uses two entries in your browser's session storage, which the website's sign-in pages write and your browser deletes when you close the tab:

emo-sign-in-pending. The one-time values of a sign-in you started (its state, its code verifier and the page to return to). Set when you press a sign-in button, and deleted when the sign-in service sends you back.
emo-signed-in. That this tab signed in, so a page load checks the session. No token, no identity. Set when a sign-in finishes, and deleted when you sign out or the session has ended.

They are used only for signing in and hold nothing that tracks you. They are strictly necessary to provide the sign-in you ask for, which section 25(2) no. 2 TDDDG allows without consent.

How long we keep it, and deleting it. We keep your account data for as long as your account exists. Signing out ends the session on our servers and deletes the cookie that kept you signed in. To have your account and the data above deleted, email hello@emolysis.com from your account's email address. We then delete your sign-in identities, sessions and memberships, remove your email address and name from the account, close any organization of which you are the only member, and delete your request for access if you made one. Records we must keep, such as the security log, keep internal identifiers only, and we keep what the law requires us to keep for as long as it requires. You can also remove Emolysis's access in your GitHub, Microsoft or Google account settings: that stops sign-ins with that account, but does not delete your Emolysis account.

11. Connecting Microsoft Fabric from the app

The Emolysis app can connect to Microsoft Fabric with your own work or school Microsoft account, through Microsoft Entra ID. It then works with your permissions in Fabric, never more. Microsoft shows you what the app asks for before you agree, and your organization's administrator may have to approve it first.

What it asks for. To read your workspaces and lakehouses, to run queries on your lakehouses, to create and update the notebooks it deploys for you in the workspaces you choose and let them run with your access to Fabric and OneLake, and to read and write files in OneLake on your behalf: the Fabric permissions Workspace.Read.All, Lakehouse.Read.All, Lakehouse.Execute.All, Item.ReadWrite.All, Code.AccessFabric.All and Code.AccessStorage.All, and Azure Storage's user_impersonation. The app asks for no other Microsoft data: not your mailbox, your OneDrive or SharePoint files, your contacts or your calendar.

Where it runs. The app talks to Fabric and OneLake directly from your computer. It keeps the sign-in Microsoft gives it, a refresh token, in your operating system's keychain on that computer, and its short-lived access tokens only in memory; if you connect with a service principal instead, its secret is kept in the same keychain. Our services are designed never to receive this sign-in or your Fabric credentials, and never to connect to Fabric.

What it reads. The names, columns, comments and owners of your lakehouses' tables, bounded samples of their rows and the results of the queries and runs you start. The app keeps them in the project on your computer; the results of its queries also pass through a folder of your lakehouse in OneLake. Data from your tables reaches our services only in prompts sent through your Emolysis account, which pass through our metering service to the AI model provider and are designed not to be stored or logged there, and in dashboards you choose to publish (section 13). If you use a model key of your own, prompts go from your computer to that provider directly.

Removing access. Microsoft lists the connection as "Emolysis Fabric connector", published by Bandpey GmbH. You can remove its access at any time in your Microsoft account settings, and your organization's administrator can remove it in Microsoft Entra ID.

12. Links to other websites

This website links to other sites, for example Emolysis's profiles on GitHub, LinkedIn, Instagram, Facebook and Crunchbase, and bandpey.com. A link takes you to a site with its own privacy notice, and pages here load nothing from those sites until you follow one.

13. What this notice covers

This notice covers the website, including the request form and signing in, which is in testing and not yet offered to the public (section 10), and the Emolysis app's connection to Microsoft Fabric (section 11). Emolysis is in private development, and there are no payments. How the planned product is designed to handle data is described on the security page.

When publishing dashboards opens, a dashboard you publish is stored by our hosting provider: only what you publish, the rows its charts show, never your source tables. It is placed in Western Europe where our hosting provider honors that placement, without a residency guarantee. Our hosting provider may process it outside the EU, including in the United States; for those transfers we rely on an adequacy decision of the European Commission where one covers the transfer (for the United States, the EU-US Data Privacy Framework, for providers certified under it), and otherwise on standard contractual clauses. EU residency is planned for when our hosting provider supports it.

Before accounts open to everyone, or sharing or billing open, we will update this notice.

14. Who receives data

Your data goes to our hosting provider (sections 3, 7, 8 and 10). If you use the request form, it also goes to our CRM provider and to our email provider, whose mailbox receives our team's notification of each request (section 7). If you email us, it goes to our email and IT providers (section 6). They process it on our behalf. Once you choose in the cookie banner, usage data goes to Google Ireland Limited (Google Analytics) and Microsoft Ireland Operations Limited (Microsoft Clarity), as section 5 describes. We pass it to authorities or advisers only where the law requires it or where we need it to establish, exercise or defend legal claims.

We do not sell personal data and we do not share it for advertising. What Microsoft does with Clarity data for its own advertising is described in section 5.

15. Your rights

Under the GDPR you have the right to:

access your personal data and information about its processing (Art. 15);
have inaccurate data corrected and incomplete data completed (Art. 16);
have data erased where the legal requirements are met (Art. 17);
restrict processing in the cases the law provides (Art. 18);
receive data you gave us in a portable format, where this applies (Art. 20);
object, on grounds relating to your situation, to processing based on legitimate interests (Art. 21).

Where processing is based on your consent, which on this website are the website analytics (section 5) and the newsletter (section 9), you can withdraw it at any time with effect for the future (Art. 7(3)). We make no decisions based solely on automated processing, and we do not profile visitors.

To use a right, email hello@emolysis.com. We may ask for proof of identity, and we normally answer within one month.

You also have the right to complain to a data protection supervisory authority. For Bandpey GmbH that is the Bavarian State Office for Data Protection Supervision (BayLDA), lda.bayern.de. You can also contact the authority where you live or work.

16. Security

Pages are served over HTTPS only. No system is completely secure, so please tell us if you think personal data about you has been exposed. For a vulnerability in the website, see how to report it.

17. Changes and contact

We update this notice when the website or the law changes, and before the website starts to collect anything it does not collect today. The date at the top shows the latest version.

Questions: hello@emolysis.com, or by post to Bandpey GmbH, Gmunder Str. 20b, 81379 Munich, Germany. Please mark postal inquiries "Privacy".